Analysis
-
max time kernel
29s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 13:33
Static task
static1
Behavioral task
behavioral1
Sample
c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe
Resource
win10v2004-20220901-en
General
-
Target
c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe
-
Size
280KB
-
MD5
e77dda259712f46ddaeb45e1831d28d9
-
SHA1
d1ee751682682038ece87f90958f7d5df9648589
-
SHA256
c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb
-
SHA512
7b36a7948b9c475e46945e2a6c66ab6fb967696ca038b015492a7966f93222d4b01e8948c990750af69a3890fff8d5fd9e7a44c4d3b3d4761eaa6badc0a6dcdd
-
SSDEEP
6144:zHCji47tHVsr54+eoKN8j/9ofYb3wLLBvfyg4yJpT221:Oicmr5gbNGgYjefy7yJpT24
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 10 IoCs
Processes:
resource yara_rule behavioral1/memory/1832-71-0x0000000000400000-0x0000000000433000-memory.dmp modiloader_stage2 behavioral1/memory/1832-72-0x0000000000400000-0x0000000000433000-memory.dmp modiloader_stage2 behavioral1/memory/1832-74-0x0000000000400000-0x0000000000433000-memory.dmp modiloader_stage2 behavioral1/memory/1832-75-0x0000000000400000-0x0000000000433000-memory.dmp modiloader_stage2 behavioral1/memory/1832-77-0x0000000000400000-0x0000000000433000-memory.dmp modiloader_stage2 behavioral1/memory/1832-78-0x0000000000407E48-mapping.dmp modiloader_stage2 behavioral1/memory/1832-79-0x0000000000400000-0x0000000000433000-memory.dmp modiloader_stage2 behavioral1/memory/1832-81-0x0000000000400000-0x0000000000433000-memory.dmp modiloader_stage2 behavioral1/memory/1832-83-0x0000000000400000-0x0000000000433000-memory.dmp modiloader_stage2 behavioral1/memory/1832-86-0x0000000000400000-0x0000000000433000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
Processes:
c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exeadobeupdater.exepid process 936 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe 852 adobeupdater.exe -
Loads dropped DLL 5 IoCs
Processes:
c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exec573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exepid process 1980 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe 1980 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe 936 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe 936 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe 936 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\VcsTTiYbTsVzxfUofWjudcQQrzMoInLdpdbVnkHqCHEPghDENl = "C:\\Users\\Admin\\AppData\\Local\\c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe" c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exedescription pid process target process PID 936 set thread context of 1832 936 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe -
Drops file in Windows directory 2 IoCs
Processes:
vbc.exedescription ioc process File opened for modification C:\Windows\adobeupdater.exe vbc.exe File created C:\Windows\adobeupdater.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
vbc.exepid process 1832 vbc.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exec573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exevbc.exedescription pid process target process PID 1980 wrote to memory of 936 1980 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe PID 1980 wrote to memory of 936 1980 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe PID 1980 wrote to memory of 936 1980 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe PID 1980 wrote to memory of 936 1980 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe PID 936 wrote to memory of 1832 936 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe PID 936 wrote to memory of 1832 936 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe PID 936 wrote to memory of 1832 936 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe PID 936 wrote to memory of 1832 936 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe PID 936 wrote to memory of 1832 936 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe PID 936 wrote to memory of 1832 936 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe PID 936 wrote to memory of 1832 936 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe PID 936 wrote to memory of 1832 936 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe PID 936 wrote to memory of 1832 936 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe PID 936 wrote to memory of 1832 936 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe PID 936 wrote to memory of 1832 936 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe PID 1832 wrote to memory of 852 1832 vbc.exe adobeupdater.exe PID 1832 wrote to memory of 852 1832 vbc.exe adobeupdater.exe PID 1832 wrote to memory of 852 1832 vbc.exe adobeupdater.exe PID 1832 wrote to memory of 852 1832 vbc.exe adobeupdater.exe PID 1832 wrote to memory of 852 1832 vbc.exe adobeupdater.exe PID 1832 wrote to memory of 852 1832 vbc.exe adobeupdater.exe PID 1832 wrote to memory of 852 1832 vbc.exe adobeupdater.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe"C:\Users\Admin\AppData\Local\Temp\c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe"C:\Users\Admin\AppData\Roaming\c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe3⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\adobeupdater.exe"C:\Windows\adobeupdater.exe" \melt "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exeFilesize
280KB
MD5e77dda259712f46ddaeb45e1831d28d9
SHA1d1ee751682682038ece87f90958f7d5df9648589
SHA256c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb
SHA5127b36a7948b9c475e46945e2a6c66ab6fb967696ca038b015492a7966f93222d4b01e8948c990750af69a3890fff8d5fd9e7a44c4d3b3d4761eaa6badc0a6dcdd
-
C:\Users\Admin\AppData\Roaming\c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exeFilesize
280KB
MD5e77dda259712f46ddaeb45e1831d28d9
SHA1d1ee751682682038ece87f90958f7d5df9648589
SHA256c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb
SHA5127b36a7948b9c475e46945e2a6c66ab6fb967696ca038b015492a7966f93222d4b01e8948c990750af69a3890fff8d5fd9e7a44c4d3b3d4761eaa6badc0a6dcdd
-
C:\Windows\adobeupdater.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
C:\Windows\adobeupdater.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
\Users\Admin\AppData\Roaming\Twain.dllFilesize
18KB
MD52153e2d85da316a0fe302227e0f9af88
SHA148b334c27d604ce7d89c9c825d211d26427176cf
SHA256645b30a3ef5cf05ad0df575fbbdbc05387b5493ce1778935b60d98681fea7bc0
SHA512647b0b95622c2e9086f072ccf110371b38953619b4cb6697e259165ce12e0dd1854bc6351abb8f693d052d730f8790d72929a8c822a26ac369c372478c1e4fac
-
\Users\Admin\AppData\Roaming\Twain.dllFilesize
18KB
MD52153e2d85da316a0fe302227e0f9af88
SHA148b334c27d604ce7d89c9c825d211d26427176cf
SHA256645b30a3ef5cf05ad0df575fbbdbc05387b5493ce1778935b60d98681fea7bc0
SHA512647b0b95622c2e9086f072ccf110371b38953619b4cb6697e259165ce12e0dd1854bc6351abb8f693d052d730f8790d72929a8c822a26ac369c372478c1e4fac
-
\Users\Admin\AppData\Roaming\Twain.dllFilesize
18KB
MD52153e2d85da316a0fe302227e0f9af88
SHA148b334c27d604ce7d89c9c825d211d26427176cf
SHA256645b30a3ef5cf05ad0df575fbbdbc05387b5493ce1778935b60d98681fea7bc0
SHA512647b0b95622c2e9086f072ccf110371b38953619b4cb6697e259165ce12e0dd1854bc6351abb8f693d052d730f8790d72929a8c822a26ac369c372478c1e4fac
-
\Users\Admin\AppData\Roaming\c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exeFilesize
280KB
MD5e77dda259712f46ddaeb45e1831d28d9
SHA1d1ee751682682038ece87f90958f7d5df9648589
SHA256c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb
SHA5127b36a7948b9c475e46945e2a6c66ab6fb967696ca038b015492a7966f93222d4b01e8948c990750af69a3890fff8d5fd9e7a44c4d3b3d4761eaa6badc0a6dcdd
-
\Users\Admin\AppData\Roaming\c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exeFilesize
280KB
MD5e77dda259712f46ddaeb45e1831d28d9
SHA1d1ee751682682038ece87f90958f7d5df9648589
SHA256c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb
SHA5127b36a7948b9c475e46945e2a6c66ab6fb967696ca038b015492a7966f93222d4b01e8948c990750af69a3890fff8d5fd9e7a44c4d3b3d4761eaa6badc0a6dcdd
-
memory/852-84-0x0000000000000000-mapping.dmp
-
memory/936-73-0x00000000745A0000-0x0000000074B4B000-memory.dmpFilesize
5.7MB
-
memory/936-82-0x00000000745A0000-0x0000000074B4B000-memory.dmpFilesize
5.7MB
-
memory/936-59-0x0000000000000000-mapping.dmp
-
memory/1832-78-0x0000000000407E48-mapping.dmp
-
memory/1832-79-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1832-72-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1832-74-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1832-75-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1832-77-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1832-68-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1832-69-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1832-81-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1832-71-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1832-83-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1832-86-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1980-64-0x00000000745A0000-0x0000000074B4B000-memory.dmpFilesize
5.7MB
-
memory/1980-55-0x0000000075521000-0x0000000075523000-memory.dmpFilesize
8KB
-
memory/1980-56-0x00000000745A0000-0x0000000074B4B000-memory.dmpFilesize
5.7MB